Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-33435 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Weblate Weblate. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33435 affects Weblate, a web-based localization tool, in versions prior to 5.17. The vulnerability arises because the project backup feature fails to filter Git and Mercurial configuration files, potentially allowing remote code execution under certain circumstances. It is classified under CWE-23 (Relative Path Traversal), CWE-94 (Improper Control of Generation of Code), and CWE-434 (Unrestricted Upload of File with Dangerous Type), with a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to network accessibility, changed scope, and full impact on confidentiality, integrity, and availability.
An attacker requires high privileges, specifically the ability to create projects, to access the project backup functionality and exploit this issue. Exploitation involves crafting malicious Git or Mercurial configuration files that, when processed during backup, lead to remote code execution on the server. The high attack complexity (AC:H) suggests it demands specific knowledge of the tools and configurations, with no user interaction required beyond authentication.
The issue is addressed in Weblate version 5.17. For those unable to update immediately, the advisory recommends restricting access to the project backup feature, which is limited to users able to create projects, thereby reducing the vulnerability's scope. Relevant details are available in the GitHub security advisory (GHSA-558g-h753-6m33) and the associated pull request (PR #18549).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23001
Vulnerability Data
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17.…
more
If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V5.1.1V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Access enforcement directly blocks unauthorized file reads/writes that result from unresolved .. sequences.
Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.
Least privilege reduces the set of reachable files even when a traversal succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.
Hardened configuration baselines can enforce allowed file types and processing rules.
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.
Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.